dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > CreativeZENXFiPort (r1)

Creative Zen X-Fi Port


This is the page for the Creative Zen X-Fi port. See CreativeZENXFi for more information about the device.


The firmware structure is similar to the one of the older Creative players. See CreativeZVMPort for more info. The biggest difference is that the rescue firmware (aka FRESC) uses the SbFileFormat. Unfortunately the firmware is encrypted and the key is not known but using on-device crypto, I have been able to decrypt it.

--+ Extracting the firmware

You can use the zenutils from the SVN (in utils/zenutils). First use update_extract to extract the archive from the updater executable and then firmware_extract to extract the files from the archive. Note that the main firmware (in the ŠTL block) is using the TL encryption mode.

--+ Sending the firmware

You can rewrite the firmare of the device by booting in recovery mode (shut off, hold play, power on). Then erase the old firmware using the "reloading the firmware" entry and send a new one with the senfirm tool available in the SVN (in utils/MTP). Not that the device is using MTP mode and that writing a new firmware is merely a question of sending "nk.bin" file with type firmware (and with the correct format). Fortunately the device accept firmware images consisting only in CIFF, ŠTL and NULL blocks.

--+ Decrypting FRESC

The FRESC file is the rescue firmware (that you DONT want to overwrite). It uses an unknown public key but because of the way the SbFileFormat is designed and because I have been able to decrypting it on device, it is still possible the extract it using the sbtools in the SVN (in utils/MTP) this way:

SB_REAL_KEY="78B092EB8370D4C3BC13B3BF42C8EBB6" sbtoelf -zf FRESC

This has been tested with the ZENXFI_PCFW_L22_1_04_08e.exe updater only.
r1 - 30 Jun 2012 - 23:58:31 - AmauryPouly

Copyright Š by the contributing authors.